@gonzih/cc-tg 0.2.3 → 0.2.5

package/README.md

@@ -53,6 +53,8 @@ Message [@userinfobot](https://t.me/userinfobot) on Telegram — it replies with
 | `/cron clear` | Remove all cron jobs |
 | Any text | Sent directly to Claude Code |
 | Voice message | Transcribed via whisper.cpp and sent to Claude |
+| Photo | Sent as native image input to Claude (base64 content block) |
+| Document / file | Downloaded to `<CWD>/.cc-tg/uploads/`, path passed to Claude as `ATTACHMENTS: [name](path)` |
 
 ## Features
 
@@ -62,6 +64,12 @@ Each Telegram chat ID gets its own isolated Claude Code subprocess. Sessions sur
 ### Voice messages
 Send a voice message → automatically transcribed via whisper.cpp → fed into Claude as text. Requires `whisper-cpp` and `ffmpeg` installed on the host.
 
+### Images
+Send a photo → downloaded and base64-encoded → sent to Claude as a native image content block via the stream-JSON protocol. Claude sees the full image, no intermediate vision step. Caption (if any) is included as text alongside the image.
+
+### Documents
+Send any file as a document → downloaded to `<CWD>/.cc-tg/uploads/<filename>` → Claude receives the path as `ATTACHMENTS: [filename](path)` and can read/process it directly. Works for PDFs, CSVs, code files, etc.
+
 ### File delivery
 When Claude writes a file and mentions it in the response, the bot automatically uploads it to Telegram. Hybrid detection: tracks `Write`/`Edit` tool calls during the session, cross-references with filenames mentioned in the final response.
 

package/dist/bot.d.ts

@@ -18,12 +18,14 @@ export declare class CcTgBot {
     private handleTelegram;
     private handleVoice;
     private handlePhoto;
+    private handleDocument;
     private getOrCreateSession;
     private handleClaudeMessage;
     private startTyping;
     private stopTyping;
     private flushPending;
     private trackWrittenFiles;
+    private isSensitiveFile;
     private uploadMentionedFiles;
     private extractToolName;
     private handleCron;

package/dist/bot.js

@@ -3,8 +3,8 @@
  * One ClaudeProcess per chat_id — sessions are isolated per user.
  */
 import TelegramBot from "node-telegram-bot-api";
-import { existsSync } from "fs";
-import { resolve, basename } from "path";
+import { existsSync, createWriteStream, mkdirSync } from "fs";
+import { resolve, basename, join } from "path";
 import https from "https";
 import http from "http";
 import { ClaudeProcess, extractText } from "./claude.js";
@@ -60,6 +60,11 @@ export class CcTgBot {
             await this.handlePhoto(chatId, msg);
             return;
         }
+        // Document — download to CWD/.cc-tg/uploads/, tell Claude the path
+        if (msg.document) {
+            await this.handleDocument(chatId, msg);
+            return;
+        }
         const text = msg.text?.trim();
         if (!text)
             return;
@@ -147,6 +152,31 @@ export class CcTgBot {
             await this.bot.sendMessage(chatId, `Failed to process image: ${err.message}`);
         }
     }
+    async handleDocument(chatId, msg) {
+        const doc = msg.document;
+        const caption = msg.caption?.trim();
+        const fileName = doc.file_name ?? `file_${doc.file_id}`;
+        console.log(`[doc:${chatId}] received document file_name=${fileName} mime=${doc.mime_type}`);
+        this.bot.sendChatAction(chatId, "typing").catch(() => { });
+        try {
+            const uploadsDir = join(this.opts.cwd ?? process.cwd(), ".cc-tg", "uploads");
+            mkdirSync(uploadsDir, { recursive: true });
+            const destPath = join(uploadsDir, fileName);
+            const fileLink = await this.bot.getFileLink(doc.file_id);
+            await downloadToFile(fileLink, destPath);
+            console.log(`[doc:${chatId}] saved to ${destPath}`);
+            const prompt = caption
+                ? `${caption}\n\nATTACHMENTS: [${fileName}](${destPath})`
+                : `ATTACHMENTS: [${fileName}](${destPath})`;
+            const session = this.getOrCreateSession(chatId);
+            session.claude.sendPrompt(prompt);
+            this.startTyping(chatId, session);
+        }
+        catch (err) {
+            console.error(`[doc:${chatId}] error:`, err.message);
+            await this.bot.sendMessage(chatId, `Failed to receive document: ${err.message}`);
+        }
+    }
     getOrCreateSession(chatId) {
         const existing = this.sessions.get(chatId);
         if (existing && !existing.claude.exited)
@@ -276,6 +306,16 @@ export class CcTgBot {
             session.writtenFiles.add(resolved);
         }
     }
+    isSensitiveFile(filePath) {
+        const name = basename(filePath).toLowerCase();
+        const sensitivePatterns = [
+            /credential/i, /secret/i, /password/i, /passwd/i, /\.env/i,
+            /api[_-]?key/i, /token/i, /private[_-]?key/i, /id_rsa/i,
+            /\.pem$/i, /\.key$/i, /\.pfx$/i, /\.p12$/i,
+            /gmail/i, /oauth/i, /auth/i,
+        ];
+        return sensitivePatterns.some((p) => p.test(name));
+    }
     uploadMentionedFiles(chatId, resultText, session) {
         if (session.writtenFiles.size === 0)
             return;
@@ -306,9 +346,13 @@ export class CcTgBot {
                 }
             }
         }
-        // Deduplicate
+        // Deduplicate and filter sensitive files
         const unique = [...new Set(toUpload)];
         for (const filePath of unique) {
+            if (this.isSensitiveFile(filePath)) {
+                console.log(`[claude:files] skipping sensitive file: ${filePath}`);
+                continue;
+            }
             console.log(`[claude:files] uploading to telegram: ${filePath}`);
             this.bot.sendDocument(chatId, filePath).catch((err) => console.error(`[tg:${chatId}] sendDocument failed for ${filePath}:`, err.message));
         }
@@ -395,6 +439,18 @@ function fetchAsBase64(url) {
         }).on("error", reject);
     });
 }
+/** Download a URL to a local file path */
+function downloadToFile(url, destPath) {
+    return new Promise((resolve, reject) => {
+        const client = url.startsWith("https") ? https : http;
+        const file = createWriteStream(destPath);
+        client.get(url, (res) => {
+            res.pipe(file);
+            file.on("finish", () => file.close(() => resolve()));
+            file.on("error", reject);
+        }).on("error", reject);
+    });
+}
 function splitMessage(text, maxLen = 4096) {
     if (text.length <= maxLen)
         return [text];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gonzih/cc-tg",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Claude Code Telegram bot — chat with Claude Code via Telegram",
   "type": "module",
   "bin": {